RDP Event ID 22: Shell start
Remote Desktop Services: Shell start notification receivedRDP event 22 is logged when the user's shell (Explorer) starts in a new session, right after the session logon event 21.
22
- Event ID
- 22
- Channel
- Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
- Provider
- Microsoft-Windows-TerminalServices-LocalSessionManager
- Log file
- Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx
- Category
- Remote access
- Default logging
- Logged by default
What event 22 means
Event 22 records that the desktop shell started for a newly logged-on session. It normally follows event 21 within seconds and carries the same user, session ID and source address.
It adds little beyond 21, but its presence confirms the session reached a usable desktop. A 21 without a following 22 can indicate a session that was closed or failed during logon.
When it is logged
Audit policy / configuration
None — the LocalSessionManager/Operational channel is enabled by default.
Key fields
| Field | What it tells you |
|---|---|
| User | Account whose shell started. |
| SessionID | Session number, same as in the preceding 21. |
| Address | Source IP of the RDP client or LOCAL. |
Common benign sources
- Every normal interactive or RDP logon.
What attackers do that produces it
- Same significance as 21 — an interactive desktop became available to whoever logged on.
Investigation tips
- Use it with 21 to confirm a full interactive session rather than an aborted logon.
- The Address should match 21 and the preceding 1149.
MITRE ATT&CK techniques
| Technique | Tactics |
|---|---|
| T1021.001 Remote Services: Remote Desktop Protocol | Lateral Movement |
MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.
Sigma rules for this event
No bundled SigmaHQ rule targets this event ID specifically. Rules on related events may still cover the activity.
Run these rules on your logs
Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.